PT-2026-26210 · Siyuan · Siyuan
CVSS v3.1
6.8
Média
| Vetor | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.6.2
Description
SiYuan, a personal knowledge management system, has an issue in the
IsSensitivePath() function within kernel/util/path.go. This function employs a denylist approach to restrict file access, but the denylist is incomplete, failing to block several security-sensitive Linux directories including /opt, /usr, /home, /mnt, and /media. The globalCopyFiles and importStdMd API endpoints rely on this function for path validation, making them susceptible to unauthorized file access. Specifically, the globalCopyFiles endpoint, located at kernel/api/file.go:82, uses IsSensitivePath as its only path validation method. This allows an attacker to potentially read arbitrary files from the unblocked directories, including application source code, configurations, and mounted secrets, particularly in Docker deployments. The denylist approach is fundamentally flawed as any newly added filesystem path remains accessible until explicitly blocked.Recommendations
Versions prior to 3.6.2 should be updated to version 3.6.2 or later. Switch from a denylist to an allowlist approach, permitting copying only from the workspace directory and explicitly approved external paths.
Exploit
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Siyuan